doctor and sole managing director of the laboratory (first data subject) – Complaint Upheld (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A doctor and managing director faced a complaint after an unprotected file with sensitive information was shared without proper safeguards. This ruling matters because it shows the importance of protecting personal data. Business owners should ensure they have secure practices in place to handle sensitive information.
What happened
An unprotected Excel file containing sensitive information was shared from a compromised email account.
Who was affected
Individuals whose names and PCR test results were included in the unprotected file.
What the authority found
The authority upheld the complaint but did not classify specific violations under GDPR.
Why this matters
This case highlights the need for strong data protection measures. Business owners should prioritize securing sensitive data to avoid potential breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 24 August 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In August 2021, an unprotected Excel file containing the names and PCR test results of several thousand individuals was sent from the compromised email account of the first data subject, which was administered by the second data subject. The file was then forwarded by a third party to the first and second controller, who reported about the case on 01. September 2021 in their online news portals. On 02. September 2021, the second data subject requested the deletion of the news articles. The first controller forwarded this request alongside their response to the second controller. Both controllers rejected the deletion request on grounds of the journalistic exemption (Medienprivileg) under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A2P9/NOR40201397?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=9&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=BGBl+I+Nr+24%2f2018&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b49884a7-7ca2-4b7e-b190-c849f2424782 § 9(1) DSG], and also asked further questions about the case. On 09. September 2021, the second data subject requested information from both controllers regarding the processing, transmission and purpose of their data and trade secrets. Only the second controller replied to the request, stating that the data processing was for journalistic purposes and, hence, there was no right to deletion in this specific case under the media law (Mediengesetz). On 10. September 2021, the first data subject requested the provision of all their data under Article 15 GDPR from both controllers. The second controller replied on 11. October 2021, and the first controller on 15. April 2022 by essentially providing
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for doctor and sole managing director of the laboratory (first data subject) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. doctor and sole managing director of the laboratory (first data subject) - Austria (2023). Retrieved from cookiefines.eu
Last updated: